Malicious code in @johnruff215-dev/solana-wallet-tracker (npm).
CriticalGHSA-w48h-24q2-rjqx2 Nov · today
Does it affect you?
Not extractedThe conditions could not be extracted from the source.
Malicious package. @johnruff215-dev/solana-wallet-tracker is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package @notrainer/nobtrainer-sdk , indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below. --- Credit…
SourcesGitHub malware advisory
Timeline
2 Nov1 hfrom publication to Patchwire
- Published in the GitHub database2 Nov, 06:31 UTC
- Seen by Patchwire +1 h2 Nov, 07:46 UTC
@johnruff215-dev/solana-wallet-trackerNo fix found